Configuring Password Complexity in Active Directory

6.1K

Domain user passwords are an important part of the security of your Active Directory domain. An AD system administrator can manage domain password policies using Group Policy Objects and Password Settings Objects. In this article, we’ll show you how to set up or change the password complexity policy in Active Directory.

Active Directory Password Complexity

Password policy settings in Active Directory include the following parameters:

Minimum password length

This parameter defines the minimum number of characters required in a password.

Password must meet complexity requirements

Keep in mind that the password must meet these requirements:

• The password doesn’t contain the username or parts of the full name (more than 2 consecutive characters)
• The password must include at least 3 of the following character types:
  – Uppercase letters (A–Z)
  – Lowercase letters (a–z)
  – Numbers (0–9)
  – Special characters (!, @, #, etc.)

Enforce password history

This parameter specifies how many previous passwords are remembered to prevent reuse.

Examples

Here is an example of valid password:

Correct-Horse-Battery!7

(meets complexity requirements)

Here are the examples of invalid passwords:

• password (no uppercase, numbers, or special characters)
• John1234 (contains part of the username)
• 12345678 (numbers only)

Default domain password policy settings

By default, the following password complexity settings are configured in the AD domain based on Windows Server 2016:

Setting	Default Value
Minimum password length	7 characters (default domain policy)
Maximum password age	42 days
Minimum password age	1 day
Complexity requirements	Enabled
Password history	24 passwords
Reversible encryption	Disabled

Although the default minimum password length in AD is 7 characters, we currently recommend you configuring a longer minimum password length (8 or more characters) as a security best practice.

If a user tries to set a password that does not match the password policy in the AD domain when logging into Windows or changing the password via Ctrl+Alt+Delete, an error message will be displayed:

Unable to update the password. The value provided for the new password does not meet the domain’s length, complexity, or history requirements.

Note that password policy applies only at the domain level (Default Domain Policy).

Configuring the Active Directory password policy settings

In order to configure the default domain password policy:

1. First, open gpmc.msc
2. Then expand your domain
3. On the next step, right-click on Default Domain Policy, then click Edit
   

   

4. Now navigate to:
   Computer Configuration → Policies → Windows Settings → Security Settings → Account Policies → Password Policy
5. At this step, you need to configure the required settings:
   – Minimum password length
   – Password must meet complexity requirements
   – Enforce password history
   

   

 Note. Keep in mind that the password policy that you have configured in the Default Domain Policy applies to all domain users.

Comparing GPO and PSO

Method	Scope	Priority / Behavior	Management Tool
Default Domain Policy (GPO)	All domain users	Lower — applies when no PSO is assigned	gpmc.msc
PSO (Fine-Grained Password Policy)	Specific users or groups	Higher — overrides GPO when assigned	dsac.msc or PowerShell

Note. In case a few PSOs apply to the same user, the one with the lowest Precedence number takes priority. As an example: a PSO with Precedence 1 takes priority over a PSO with Precedence 10. The Default Domain Policy is always overridden by any PSO.

How to Configure Password Policy using PowerShell

To view the current default domain password policy:

Get-ADDefaultDomainPasswordPolicy

To set the minimum password length to 12 characters:

Set-ADDefaultDomainPasswordPolicy `
-Identity "theitbros.com" `
-MinPasswordLength 12 `
-PasswordHistoryCount 24 `
-ComplexityEnabled $true

Fine-Grained Password Policies (FGPP)

Fine-Grained Password Policies (FGPP) are supported in AD domains that meet the required domain functional level (introduced with Windows Server 2008 R2). They allow different password policies to be applied to specific users/groups instead of relying on a single domain-wide policy.

You can do this Password Settings Objects (PSO).

How to configure Fine-Grained Password Policies using dsac.msc

1. First, open dsac.msc (Active Directory Administrative Center)
2. Now go to System → Password Settings Container
3. Here you click New → Password Settings
4. Now you need to configure password settings (length, complexity, history, etc.)
5. In Directly applies to, add users or groups

How to configure Fine-Grained Password Policies using PowerShell

You can configure FGPP with PowerShell console:

New-ADFineGrainedPasswordPolicy `
-Name "AdminPasswordPolicy" `
-Precedence 10 `
-MinPasswordLength 16 `
-PasswordHistoryCount 24 `
-ComplexityEnabled $true `
-MaxPasswordAge "30.00:00:00"

After the step above, you need to apply PSO to a group:

Add-ADFineGrainedPasswordPolicySubject `
-Identity "AdminPasswordPolicy" `
-Subjects "Domain Admins"

When to use Fine-Grained Password Policies?

You should use FGPP in case:

• You need stricter policies for administrators
• Different departments of your organization need different rules
• Default domain policy is not flexible enough

Your new password complexity settings will now apply to all users in the specified group.

You can display the current password policy settings for a specific user using PowerShell (it shows which password policy is applied):

Get-ADUserResultantPasswordPolicy -Identity b.johnson

Password Protection in Hybrid Environments

In hybrid AD environments, password complexity policies can be complemented by Microsoft Entra Password Protection. Unlike the standard password complexity policy, Microsoft Entra Password Protection blocks weak and commonly used passwords by checking them against Microsoft’s global banned password list and optionally against a custom banned password list defined by the organization. The feature can also be deployed on-premises so that Active Directory DCs enforce the same password restrictions during password changes. Password complexity requirements and Microsoft Entra Password Protection are complementary technologies and are commonly used together in enterprise environments.

Wrapping Up

Configuring password complexity in Active Directory is important for strong security standards. Active Directory offers tools like the Group Policy Management Console and the Active Directory Administrative Center, making it easier for IT professionals to manage and apply password policies. It’s vital to set appropriate minimum password lengths, understand the importance of password history, and avoid methods like reversible encryption.

Organizations can use the fine-grained password policies feature to apply specific password policies to particular user groups. By understanding and using complexity requirements in Active Directory effectively, companies can help to bolster their cybersecurity posture and help prevent password breaches and compromise.